--- title: 'Attack Temporality: Temporal Dynamics' url: https://www.emergentmind.com/topics/attack-temporality type: topic --- # Attack Temporality: Temporal Dynamics Searching arXiv for the cited papers to ground the article in fresh paper metadata. Taken together, recent security literatures suggest that **attack temporality** is the temporal structure of an attack: the relation between payload installation, exposure, activation, propagation, and observable effect. In some settings it is modeled as a success probability that evolves with time; in others as a bounded attack window, a delay between trigger exposure and activation, a temporally localized perturbation, or a cross-session persistence class. The concept appears in attack-tree analysis, data poisoning, browser-use agents, diffusion-model backdoors, sequential adversarial examples, quantum synchronization attacks, and agentic AI security, where it serves both as a modeling primitive and as a basis for defense design [1510.00050], [2604.23338]. ## 1. Conceptual definitions and taxonomies A formal treatment of attack temporality appears in the agentic-AI security literature, where the temporality class $\tau(a)$ of an attack $a$ is defined by the **installation-to-execution gap**, i.e., the elapsed time between introduction of the attack payload and its harmful realization. For T1–T3 this gap is bounded by session structure; for T4 it is not [2604.23338]. This formulation is notable because it separates *where* an attack lives in the architecture from *when* it manifests. The same idea is instantiated differently in other domains. In Dynamic Countermeasure Trees, the attacker’s success is explicitly time-dependent, with each basic step endowed with an exponential clock [1510.00050]. In browser-use agents, attack temporality is the **TOCTOU window** $\Delta t=t_u-t_c$ between observation and execution, during which page state may change [2603.00476]. In temporal data poisoning, attack temporality is captured by **earliness** and **duration**, which measure how far in advance the attack began and how long it lasted [2302.03684]. In delayed backdoors, the central temporal object is the latency phase between trigger exposure and outbreak [2603.11949]. The four temporality classes introduced for agentic systems provide a compact taxonomy for installation-to-activation delay [2604.23338]. | Class | Gap structure | Representative threats | |---|---|---| | T1 Instantaneous | Gap $=0$; same inference call | Classical prompt injection; jailbreak | | T2 Session-Persistent | Bounded by one session | In-session chain-of-thought hijack; MCP description poisoning | | T3 Cross-Session Cumulative | Spans at least one session boundary | Memory poisoning via RAG | | T4a / T4b | Not session-bounded | Alignment drift; dormant weight-space backdoor | This taxonomy suggests that attack temporality is not a single metric but a family of temporal abstractions. Some are stochastic and continuous-time, some are discrete and session-bounded, and some are stateful without any natural session boundary. ## 2. Mathematical models of time-dependent attack behavior In Dynamic Countermeasure Trees, a time-dependent attack is modeled by a tuple $$ \mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr), $$ where $G=(V,E)$ is a finite directed acyclic graph, $r$ is the unique root, $L$ labels nodes as gates or leaf events, and each leaf carries a rate $\lambda_v>0$ [1510.00050]. For a basic attack step $v$, the success probability over time is $$ F_v(t)=1-e^{-\lambda_v t}, $$ with $\lambda_v=-\tfrac1{T_v}\ln(1-p_v)$ when a static success probability $p_v$ over a reference time $T_v$ is given. AND-gates compose via $$ F_{\mathit{AND}}(t)=\prod_{i=1}^n F_i(t), $$ and OR-gates via $$ F_{\mathit{OR}}(t)=1-\prod_{i=1}^n(1-F_i(t)). $$ Countermeasure gates are modeled as sequential detection and mitigation, with a convolution-based closed form for $F_{\mathit{CM}}(t)$ [1510.00050]. The core move is to replace a static probability by a time-indexed family $F(t)$. A different continuous-time construction appears in quantum clock synchronization, where the attacker injects a time-dependent asymmetric delay $$ \Delta(t)\equiv \frac{\alpha M(t)+\beta N(t)}{2}, $$ so that the observed synchronization error becomes $$ e(t)\equiv \delta(t)=\Delta t(t)-\Delta(t). $$ Three temporal modes are defined: a jump attack, a spike attack, and a gradual attack. The experiments use two linear drift rates, $-2$ ps per 35 s for 2100 s and $-4$ ps per 35 s, then reversed $+4$ ps/35 s, over 1750 s and 3500 s [2510.21101]. Here the temporal profile of $\Delta(t)$ determines whether short-term or long-term stability is degraded. Delayed backdoor attacks introduce an explicitly stateful latency model. Let $O$ be the cumulative count of valid trigger occurrences, $$ O=\sum_{i=1}^{N}\mathbb{I}\Bigl(\sum_{j=1}^{M}\mathbb{I}[t_j\in\mathcal{X}_i]=s\Bigr), $$ and let the decay proxy be $$ T(O)=\frac{a}{(O+1)^b},\quad a>0,\; b>0. $$ Activation occurs once $T(O)\le c$, equivalently when $O\ge O^*$, with minimal trigger count $$ O^*=\biggl\lceil \bigl(\tfrac{a}{c}\bigr)^{\tfrac1b}-1\biggr\rceil. $$ A discretized schedule $\widehat{T}(O)$ and the predicate $\mathrm{Activated}[i]$ then separate latency mode from outbreak mode [2603.11949]. This model makes the delay itself a tunable attack parameter rather than an incidental artifact. These three formalisms represent distinct uses of time: as stochastic completion time, as a controlled physical waveform, and as a stateful activation counter. Their common feature is that attack efficacy depends on *when* malicious influence is introduced and *when* it is allowed to act. ## 3. Temporal windows, budgets, and exposure intervals In temporal data poisoning, the attack budget is not the number of poisoned samples but the temporal extent of the poisoning campaign. On a discrete timeline $T=\mathbb{Z}$, each sample is a triple $(x,y,t)$ with birth date $t$, and the poisoned set is $$ D'=\bigl(D_{\rm clean}\setminus D_{\rm remove}\bigr)\cup D_{\rm insert}. $$ Under partial reliability of birth dates, if the attack period is $[t_0,t_1]$, every poisoned sample’s timestamp must satisfy $t_0\le t\le t_1$ [2302.03684]. Two temporal budgets are then defined: $$ \tau_{\rm earliness}=t_{\rm collect}-\min_{(x,y,t)\in D_{\rm poison}}t+1, $$ and $$ \tau_{\rm duration}=\max_{(x,y,t)\in D_{\rm poison}}t-\min_{(x,y,t)\in D_{\rm poison}}t+1. $$ The resulting robustness notion guarantees correct classification for all attacks bounded by earliness or duration, regardless of how many samples are poisoned [2302.03684]. Browser-use agents expose a finer-grained temporal object: the TOCTOU interval $[t_c,t_u)$ between “check time” and “use time.” If the page state changes so that $$ s_c\neq s_u \quad\wedge\quad \mathsf{Bind}(a,s_c)\neq \mathsf{Bind}(a,s_u), $$ the planned action is rebound to a different element or value, producing a TOCTOU vulnerability [2603.00476]. The benchmark distinguishes three attack vectors triggered by changes in that interval: **Type I: UI changes**, **Type II: Data changes**, and **Type III: Expiring state**. In this setting, temporality is not about cumulative exposure but about the vulnerability of a short action-execution gap. A third window-based formulation is used for diffusion-model backdoors. TEMPO-Diffusion confines malicious behavior to a contiguous reverse-diffusion exposure interval $\mathrm{TSE}=[t_{\rm begin},t_{\rm end}]$, with a time-dependent trigger $R_{\rm eff}(t)=w(t)\cdot R$ inside the interval and $R_{\rm eff}(t)=0$ outside it [2606.26285]. Beginning, middle, and end exposures are evaluated at $[1000,500]$, $[750,250]$, and $[500,0]$ of the reverse trajectory, with window types Box, Hann, and Abridged. The reported trend is strongly temporal: beginning and middle exposures yield backdoor rates up to 30% under clean-noise, whereas end exposures produce $<5\%$; larger trigger size amplifies this temporal sensitivity [2606.26285]. These examples show three distinct notions of temporal budget. **Earliness** and **duration** bound attack campaigns over months; **TOCTOU windows** bound a planning-execution race over seconds; **exposure intervals** localize malicious influence to selected timesteps of a generative process. This suggests that temporal attack analysis depends on matching the granularity of time to the system under study. ## 4. Temporal coherence in sequential adversarial attacks Several recent attacks exploit the fact that sequential models impose consistency constraints across time. In time-series forecasting, the central observation is that overlapping sliding windows make per-sample perturbations temporally inconsistent when the same timestamp receives different perturbations in different windows. Temporally Unified Adversarial Perturbations (TUAPs) replace per-sample perturbations by a global sequence $$ p=[p_\tau,p_{\tau+1},\dots,p_{N+L-1}], $$ so that for any overlapping samples the perturbation at shared timestamp $t$ is identical: $$ \delta_{i,t-i+1}=\delta_{j,t-j+1}=p_t. $$ The optimization is carried out by the Timestamp-wise Gradient Accumulation Method (TGAM), which aggregates local gradients from all windows covering each timestamp [2602.11940]. This is a direct use of temporality as a structural constraint on admissible perturbations. In reinforcement learning, temporality is modeled as correlation across the perturbation sequence $\{\delta_t\}$. The Advantage-based Adversarial Transformer (AAT) generates **time-correlated adversarial examples** by multi-scale causal self-attention and a weighted advantage $$ \tilde A_t=\frac{A_t}{1+\lambda|A_t|}, $$ which guides sampling toward high-advantage regions [2602.19582]. The paper proposes lag-1 Pearson correlation $\rho$ and mutual information $I(\delta_t;\delta_{t-1})$ as temporal-correlation measures, and reports that MSCSA+advantage sequences exhibit $\rho\approx0.8$ versus $\rho\approx0.2$ for single-step attacks like FGSM [2602.19582]. Here temporality is not only about delay but about coherent multi-step control. Event-driven spiking neural networks expose an even narrower temporal channel. Spike-retiming attacks preserve spike counts and amplitudes and alter only timestamps under three budgets: per-spike jitter $\mathcal{B}_{\infty}$, total delay $\mathcal{B}_{1}$, and tamper count $\mathcal{B}_{0}$. Feasibility requires timeline consistency, capacity-1 non-overlap, and rate preservation [2602.03284]. The projected-in-the-loop (PIL) method combines differentiable soft retiming with strict forward projection to maintain a feasible discrete schedule. Experimentally, local jitter under $\mathcal{B}_{\infty}$ fools more than $96\%$ of samples, and on DVS-Gesture the attack reaches over $90\%$ ASR while touching fewer than $2\%$ of spikes under $\mathcal{B}_{0}$ [2602.03284]. Temporality is therefore the primary perturbation axis, not a secondary one. Marked temporal point processes provide a continuous-time analogue. A continuous-time event sequence $$ H=\{(t_i,c_i)\mid t_1<\dots